Varnish Cache CVE-2025-47905 VSV00016

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:03 vuln.today

DescriptionCVE.org

Alpine Linux: varnish fixed in 7.7.1-r0

AnalysisAI

Varnish Cache on Alpine Linux contains a security vulnerability addressed in package version 7.7.1-r0, tracked as VSV00016 by the Varnish project. The specific vulnerability class, attack vector, and impact are not disclosed in the available intelligence data. No CVSS score or CWE classification has been published at time of analysis, making precise impact characterization impossible without consulting the upstream Varnish Security Advisory VSV00016 directly. No public exploit identified at time of analysis.

Technical ContextAI

Varnish Cache is a high-performance HTTP accelerator and reverse proxy commonly deployed in front of web servers to cache content and reduce backend load. The fix is delivered via the Alpine Linux package ecosystem as varnish 7.7.1-r0, indicating the upstream Varnish project released version 7.7.1 containing the security fix. The VSV00016 designation follows the Varnish project's internal security advisory numbering scheme (Varnish Security Vulnerability). No CWE classification was provided, so the root cause vulnerability class - whether memory safety, input validation, access control, or otherwise - cannot be confirmed from available data. No CPE strings were provided to further scope affected product configurations.

Affected ProductsAI

Varnish Cache versions prior to 7.7.1 as packaged for Alpine Linux are affected, with the fixed version being the Alpine package varnish 7.7.1-r0. The exact range of vulnerable upstream Varnish versions (e.g., whether earlier major versions such as 7.6.x or 7.5.x are also affected) is not determinable from the provided data. No CPE strings were supplied to further characterize affected configurations. Operators should consult the Varnish project's VSV00016 advisory directly for the full affected version matrix and any additional affected platforms beyond Alpine Linux.

RemediationAI

Upgrade the Alpine Linux varnish package to version 7.7.1-r0 or later using the standard Alpine package manager: 'apk upgrade varnish'. This is the vendor-released patch per the Alpine Linux security report. For non-Alpine deployments, consult the upstream Varnish project's VSV00016 advisory for the corresponding fixed release. Because no technical details of the vulnerability are available from provided data, specific workarounds cannot be recommended - applying the patch is the only confirmed remediation. Until patched, organizations may consider temporarily restricting network access to Varnish management interfaces as a generic compensating control, though this trade-off (reduced operability vs. risk reduction) should be weighed against the unknown severity of the vulnerability.